SEGURIDAD DE PLUGINS
MainWP Child establishes a secure link between your WordPress sites and your self-hosted MainWP Dashboard, simplifying site management.
mainwp-childbackupsmonitoringsecuritysite managementupdate
4 CVEs conocidos registrados para MainWP Child. Reportadas entre 2015 y 2026.
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2026-27366 | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 6.1.2 | Falta de control de autorización | Alta 7,5 | < 6.1.2 | 6.1.2 | 2026-06-23 | — |
| CVE-2024-10783 | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 5.3 | Falta de control de autorización | Alta 8,1 | < 5.3 | 5.3 | 2024-12-12 | — |
| CVE-2023-3132 | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 4.4.1.2 | Exposición de información sensible a un actor no autorizado | Alta 7,5 | < 4.4.1.2 | 4.4.1.2 | 2023-06-23 | — |
| CVE-2021-24877 | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 4.1.8 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Alta 7,2 | < 4.1.8 | 4.1.8 | 2021-10-25 | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 3.4.5 | — | Desconocido | < 3.4.5 | 3.4.5 | 2018-03-02 | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 3.4.5 | — | Desconocido | < 3.4.5 | 3.4.5 | 2018-02-18 | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.28 | — | Desconocido | < 2.0.28 | 2.0.28 | 2015-09-07 | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.23 | — | Desconocido | < 2.0.23 | 2.0.23 | 2015-08-07 | — |
The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.1.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note versions up to 5.3.3 contained a patch, though a bypass was discovered and not addressed until version 5.3.4.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion of the back-up files fail.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Authentication Bypass vulnerability found by Slavco in WordPress MainWP Child plugin (versions <=3.4.4).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The MainWP Child plugin for WordPress is vulnerable to authentication bypass due to insufficient validation on the check_login function in versions up to, and including, 3.4.4. This makes it possible for attackers to become administrative users and take full control of the affected website.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The MainWP Child plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.0.27 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Unspecified vulnerability in the MainWP Dashboard and MainWP Child plugins in versions up to and including 2.0.22 for WordPress has unspecified impact and remote attack vectors.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.9.2 | — | Desconocido | < 2.0.9.2 | 2.0.9.2 | 2015-03-09 | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.9.2 | — | Desconocido | < 2.0.9.2 | 2.0.9.2 | 2015-03-09 | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.23 | — | Desconocido | < 2.0.23 | 2.0.23 | — | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 3.4.5 | — | Desconocido | < 3.4.5 | 3.4.5 | — | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.9.2 | — | Desconocido | < 2.0.9.2 | 2.0.9.2 | — | — |
Because of this vulnerability, anyone can log in as an administrator just by knowing the target user’s handle (password bypass). Update this plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The MainWP Child – Securely connects sites to the MainWP WordPress Manager Dashboard plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.9.1. This is due to a missing credential check within the WordPress init hook. This makes it possible for unauthenticated attackers to log in as any user, including administrator-level accounts, if the attacker knows the username.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Email sent from vendor to users: "Today we released updates to both the MainWP Dashboard (2.0.23) and MainWP Child (2.0.23) that contain additional security hardening for a possible issue found by Francois Harvey and reported through out White Hat Reward Program. We encourage everyone to update both their MainWP Dashboard and Child site as soon as possible then follow the security hardening procedure that will be listed at the top of your MainWP Dashboard. Once you have completed the update the warning will go away."
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
Not authorized attacker could gain full control of target application if he knows the administrative user name. In case of openssl installed on the server then one request is enough and in case of md5 verification ~100k requests will do the job.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
The MainWP Child – Securely connects sites to the MainWP WordPress Manager Dashboard WordPress plugin was affected by an Authentication Bypass security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.